Data Processing Agreement (DPA)

pursuant to Art. 28 of the General Data Protection Regulation (GDPR)

Version 1.6

Between
[Your dog school – added when the contract is concluded]
[Address – added when the contract is concluded]
– hereinafter referred to as the “Controller” –

and
Joos Soft Solutions
Listweg 4, 72581 Dettingen an der Erms, Germany
– hereinafter referred to as the “Processor” –

1. Subject matter and duration of the agreement

(1) The Processor provides services in the field of software as a service (SaaS) for the Controller. The subject matter of this agreement is the provision of an app for managing dog schools, customers, dogs, appointments, payments and in-app communication (chat) as well as the modules activated by the Controller (in particular shop, email marketing/newsletters, link pages, dog school directory and Academy for online courses) in accordance with the main contract concluded (the Processor's terms and conditions for dog schools).

(2) The duration of this agreement is based on the term of the main contract, including the transition period under § 6a of the terms and conditions. In the event of contradictions between the main contract and this agreement, this agreement takes precedence with regard to the processing of personal data on behalf of the Controller.

2. Nature and purpose of the processing

(1) Nature of the processing: the processing comprises the collection, storage, retrieval, consultation, use, transmission and erasure of data by means of the cloud infrastructure provided by the Processor.

(2) Purpose of the processing: provision of the software functionalities (appointment booking, customer management, payment processing, invoicing, chat communication, push notifications, sending of the Controller's newsletters and automated messages, link pages, provision and sale of online courses) for the Controller's customers and trainers.

(3) This agreement does not cover processing for which the Processor itself is the controller, in particular the management of the contractual relationship with the Controller, the learners' accounts in the Academy (registration, sign-in, security), the Processor's own newsletter and the handling of notices under the Digital Services Act. The Processor's privacy policy provides information on this.

(4) Rule-based functions that the Controller configures itself – such as the automatic unlocking of Academy courses based on the level, subscription or course participation of its customers, reminders, waiting lists or the publication of its directory entry – are carried out by the Processor exclusively as an instruction of the Controller and only within the Controller's tenant. Data is not combined with data of other dog schools; the functions do not make any decisions with legal effect within the meaning of Art. 22 GDPR.

(5) The statutory functions for the Controller's consumer contracts (withdrawal function under § 356a BGB, cancellation button under § 312k BGB) process the information required for this purpose (name, contract designation, email address, time of receipt) on the instructions of the Controller; the Processor sends the legally required acknowledgements of receipt on behalf of the Controller.

3. Types of personal data and categories of data subjects

(1) Types of data:

• Master data (first name, last name, email address, phone number, encrypted passwords/auth IDs)
• Dog data (name, breed, date of birth, microchip number, training level, images)
• Contract and booking data (booked courses, appointments, attendance, training progress/achievements)
• Communication data (content of chat messages between trainers and customers)
• Financial data (transaction history, credit, invoice numbers, Stripe IDs)
• Technical data (device IDs/push tokens, IP addresses for system logs)
• Marketing data (consents to newsletters and advertising with time, wording and IP address, unsubscriptions, delivery status; no open or click tracking of individual recipients)
• Academy data (orders, billing addresses, access rights, learning progress and playback position)
• Documents and uploads (e.g. proof of vaccination, signed documents, homework videos and images)
• Training reports (texts, photos and videos from training, exercise ratings, homework) and check-in data (time and recording person for QR check-in)
• Employee data of the Controller (access data and permissions, recorded working hours, journeys, kilometres and mileage rates, monthly closings)

(2) Categories of data subjects:

• Customers of the Controller (dog owners)
• Staff/trainers of the Controller
• Prospective customers and newsletter subscribers of the Controller
• Buyers of and participants in the Controller's online courses
• Persons depicted in photos or videos uploaded by the Controller (e.g. accompanying persons in training, including minors)

(3) Special categories of personal data (Art. 9 GDPR) are not the subject of the processing; the Controller ensures that such data is not entered into free-text fields, chats or documents unless this is strictly necessary.

4. Obligations of the Processor

(1) The Processor processes personal data exclusively within the scope of the agreements made and in accordance with the documented instructions of the Controller.

(2) The Processor confirms that it complies with the requirements of Art. 28 to 33 GDPR. In particular, it ensures the implementation of appropriate technical and organisational measures (TOMs) pursuant to Art. 32 GDPR (see Annex 1).

(3) Where possible, the Processor supports the Controller with suitable technical and organisational measures in fulfilling data subjects' rights (e.g. access, rectification, erasure). (Note: the app functionality ensures that user data can be deleted/edited directly by the Controller or the data subject.)

(4) Audit rights of the Controller (Art. 28 (3) (h) GDPR): the Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR. It allows for and contributes to audits, including inspections, conducted by the Controller or by an auditor mandated by the Controller who is bound by confidentiality. Proof may primarily be provided by up-to-date information, documentation of the technical and organisational measures and evidence from the sub-processors (e.g. certificates, audit reports). On-site inspections must be carried out with reasonable advance notice (usually 14 days) during normal business hours and without disrupting operations; in the case of sub-processors' data centres, their evidence replaces an inspection of the Processor's own.

(5) Notification obligations in the event of data breaches: the Processor notifies the Controller without undue delay (usually within 24 hours), but no later than after 48 hours, of any breach of the security of personal data processed under this agreement. The notification must contain all information relevant to the dog school's notification obligation (pursuant to Art. 33 GDPR).

(6) Confidentiality (Art. 28 (3) (b) GDPR): the Processor ensures that all persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that these persons process personal data exclusively on the instructions of the Controller.

(7) Assistance under Art. 32 to 36 GDPR (Art. 28 (3) (f) GDPR): taking into account the nature of the processing and the information available to it, the Processor assists the Controller in complying with the obligations regarding the security of processing, the notification of data breaches, data protection impact assessments and prior consultation of the supervisory authority.

(8) Instructions (Art. 28 (3) (a) and (3) subparagraph 2 GDPR): the Controller generally issues instructions by using and configuring the software (e.g. activating a module, deleting data) and in text form. If the Processor is of the opinion that an instruction infringes data protection provisions, it informs the Controller without undue delay and may suspend its execution until it is confirmed or changed. If the Processor is required by law to carry out processing, it informs the Controller of this in advance, unless the law prohibits this.

(9) Transfers to third countries only take place on the documented instructions of the Controller – which are given with this agreement for the sub-processors listed in section 5 – and only if the requirements of Art. 44 et seq. GDPR are met (adequacy decision, in particular the EU-US Data Privacy Framework, or EU standard contractual clauses). If a transfer is based on standard contractual clauses, the Processor has carried out a transfer impact assessment and makes it available to the Controller on request. If a basis for transfer ceases to apply (for example due to a decision of the European Court of Justice on the Data Privacy Framework), the Processor switches without undue delay to another permissible basis or to a service provider in the EU and informs the Controller.

(10) Data that the Controller transmits to third parties via an interface it has activated (e.g. accounting programs such as sevDesk or lexoffice, its own webhooks or the API) is transmitted on its instructions to these recipients chosen by it; these are not sub-processors of the Processor. The Controller is responsible for the legal basis and for any contracts required with these recipients.

(11) The Processor's contact person for data protection matters and notifications under paragraph 5 is Mika Joos, email: info@pfotencard.de. The Processor is currently not obliged to appoint a data protection officer.

5. Engagement of sub-processors

(1) The Controller consents to the engagement of the sub-processors listed below. The Processor concludes a contract with each sub-processor that imposes on it essentially the same data protection obligations as this agreement (Art. 28 (4) GDPR) and is liable to the Controller for their compliance.

Sub-processors currently engaged:

• Supabase (backend as a service, database hosting, authentication) – server location: Dublin, Ireland (AWS EU).
• Vercel Inc. (frontend/app hosting, API servers) – server locations in the EU: Frankfurt am Main, Germany (websites and apps) and Dublin, Ireland (API servers); insofar as Vercel Inc. (USA) accesses data in the course of support or operations, safeguarded by the EU-US Data Privacy Framework and EU standard contractual clauses.
• Resend Inc. (sending of system emails) – data processing possibly in third countries (USA), safeguarded by the adequacy decision of the EU Commission (EU-US Data Privacy Framework) and by EU standard contractual clauses.
• Stripe Payments Europe, Ltd. (payment processing) – data processing possibly in third countries (USA), safeguarded by the adequacy decision of the EU Commission (EU-US Data Privacy Framework) and by EU standard contractual clauses. Note: for the payment processing itself, fraud prevention and the legally required identity verification (KYC), Stripe acts under its own terms as an independent controller vis-à-vis the Controller (Stripe Connect agreement); Stripe only acts as a sub-processor insofar as the Processor retrieves and displays payment data via the Stripe interface.
• Browserless (generation of PDF documents such as diplomas, certificates and legal text attachments via an external browser service; provider based in the USA) – short-term processing of the information contained in the document (e.g. name of the customer and the dog) without permanent storage; transfer on the basis of EU standard contractual clauses.
• OpenStreetMap Foundation (Nominatim), Cambridge, United Kingdom (address autocompletion when entering addresses; transmission of search input and IP address) – United Kingdom covered by an adequacy decision of the EU Commission (Art. 45 GDPR).
• Functional Software, Inc. (Sentry) (error monitoring of the app; technical error reports without session recording; server location EU) – possibly data transfer to third countries (USA), safeguarded by EU standard contractual clauses or the adequacy decision (EU-US Data Privacy Framework).
• Google Ireland Limited, Dublin, Ireland (optional sign-in/registration “Sign in with Google” via Supabase Auth; transmission of email address, name and Google account ID only if the user chooses this sign-in method) – data transfer to the USA on the basis of the EU-US Data Privacy Framework and EU standard contractual clauses.
• BunnyWay d.o.o. (bunny.net), Ljubljana, Slovenia (storage, conversion and delivery of the Academy's videos via a content delivery network; processing of the IP address, time and device data of the persons accessing them) – based in the EU; delivery may take place via servers of the content delivery network outside the EU, safeguarded by EU standard contractual clauses or adequacy decisions.

Web push services: for push notifications, the software passes the notification to the push service specified by the browser or operating system of the end device (e.g. Google Firebase Cloud Messaging, Mozilla Push Service, Apple Push Notification Service, Microsoft Windows Push Notification Service). The content is end-to-end encrypted in accordance with the Web Push standard; the push service only receives the device address and delivery metadata. The services may transfer data to the USA (where certified: EU-US Data Privacy Framework). Push notifications are only sent to users who have activated them on their device.

(2) If the Processor changes a sub-processor or adds a new one, it informs the Controller at least 30 days in advance in text form (e.g. by email or in the operator portal); in the event of imminent danger (e.g. failure of a service provider), the period may be shorter. The Controller may object to the change in text form within this period for an important reason under data protection law. If the parties cannot reach an agreement, the Controller may terminate the main contract with effect from the time the change takes effect; the Processor is not obliged to refrain from using the sub-processor. Maintenance and testing services as well as purely ancillary services (e.g. telecommunications) do not constitute sub-processing relationships.

6. Return and erasure of data

(1) After completion of the contractual work or after termination of the main contract, the Processor must, at the Controller's choice, erase in compliance with data protection law or return all personal data, documents and processing and usage results that have come into its possession in connection with the processing relationship, unless statutory retention obligations exist (Art. 28 (3) (g) GDPR).

(2) Data is returned via the export function (ZIP archive with JSON and CSV files) during the term of the contract and the transition period of 30 days after the end of the contract (§ 6a of the terms and conditions). After the transition period has expired, the Processor deletes the data from the production systems; copies remaining in backups are overwritten as part of the regular backup cycle and are not processed further until then. On request, the Processor confirms the deletion in text form.

7. Internal usage statistics and product improvement

(1) The Processor is entitled to create aggregated and anonymised usage statistics from the data processed under this agreement and to evaluate them internally (e.g. number of modules used, homework uploaded, chat messages sent, appointments booked, shop orders, certificates issued, level systems and branding settings configured) in order to further develop the software, analyse errors, improve support and ensure the secure operation of the platform.

(2) These evaluations are carried out exclusively in aggregated form (figures/key figures per dog school or platform-wide). It is not possible to draw conclusions about individual data subjects (in particular the Controller's customers/dog owners); names, message content, contact details or other individual personal data are neither evaluated nor displayed or exported for this purpose.

(3) As this is anonymised, aggregated information without personal reference, this evaluation serves to fulfil the Processor's own contractual obligation to provide, maintain and further develop the software pursuant to Art. 28 (3) sentence 2 GDPR and does not constitute processing contrary to the Controller's instructions. Access to individual data of data subjects only takes place within the scope of section 8.

8. Support and remote access to the Controller's data

(1) In the course of support, error analysis and the handling of abuse, it may be necessary for staff of the Processor to access individual data (e.g. user accounts, bookings, orders) of the Controller or to log in to the Controller's tenant environment (impersonation of the administrator account). The Controller hereby issues the instruction that such access may only take place (a) at the request of the Controller in a specific support case, (b) to handle an abuse report under the terms of use or the Digital Services Act, or (c) insofar as this is necessary to avert a specific risk to the security of the platform. In doing so, the Processor chooses the least intrusive sufficient form: access primarily takes place via a read-only view in which the names, contact details and addresses of customers are replaced by identifiers (pseudonymised) and message content is hidden; access is limited to 60 minutes. Logging in to the administrator account only takes place if the support case cannot be resolved otherwise.

(2) In order to support the Controller, analyse errors and ensure secure operation, the Processor may view the Controller's settings and content without personal reference in a read-only view (in particular design, texts, services and prices, level system, activated modules, legal texts, appointments without details of participants and trainers, as well as counts, but without monetary amounts). Personal data on customers, staff and trainers is technically removed on the server before display, in particular names, contact details and addresses of all user accounts, assignments of participants and trainers, messages and individual customer and staff records. Should isolated personal data remain in free-form texts of the Controller that is not recognisable as such, it is neither evaluated nor stored nor passed on. This view does not constitute access to individual data of data subjects within the meaning of paragraph 1 and is not logged individually.

(3) Every access under paragraph 1 is recorded by the Processor in the audit log of the respective tenant with the time, acting person, occasion, reference (for requests from the Controller) and justification. The Controller can view the logs at any time in the operator portal under “Subscription & payments” › “Data processing (DPA)” › “Support access” or request them from the Processor. The logs are retained for the duration of the main contract.

(4) No further access to individual data of data subjects – in particular cross-tenant evaluations with personal reference – takes place.

9. Liability and final provisions

(1) Art. 82 GDPR applies to liability towards data subjects. As between the parties, the liability provisions of the main contract apply, unless Art. 82 GDPR mandatorily provides otherwise.

(2) Amendments and additions to this agreement require text form. The Processor identifies each version with a version number; a new version only becomes effective upon confirmation by the Controller, and until then the most recently confirmed version continues to apply.

(3) Should a provision of this agreement be invalid, the validity of the remaining provisions remains unaffected. The law of the Federal Republic of Germany applies.

Annex 1: Technical and organisational measures (TOMs)

The Processor has implemented the following data security measures pursuant to Art. 32 GDPR:

1. Pseudonymisation and encryption (Art. 32 (1) (a) GDPR)

• Transport encryption: all data transfers between the app (frontend) and the servers (backend) are always TLS/SSL-encrypted (HTTPS / WSS).
• Encryption at rest: the databases on the Supabase servers (AWS) are encrypted by default at storage level (disk encryption). Passwords are never processed in plain text but are secured using strong hashing algorithms.

2. Confidentiality (Art. 32 (1) (b) GDPR)

• Physical access control: the servers are operated in data centres of the hosting providers in the EU (Dublin, Ireland, and Frankfurt am Main), whose physical access controls are evidenced by the providers' security certifications (e.g. ISO 27001/SOC 2).
• System access control: the Processor's administrators use strong passwords and two-factor authentication (2FA) to access the hosting dashboards (Supabase/Vercel). The Processor's administration area (super admin) can likewise only be accessed with a password and two-factor sign-in via an authenticator app; the session ends after 12 hours at the latest. The Controller can also activate two-factor sign-in via an authenticator app for the accounts of the Controller and its staff; if it is active, the server only accepts requests from this account after a confirmed code.
• Support access (section 8): the Processor's support views are read-only and limited in time to 60 minutes. The support view removes personal data on the server before display; the data view can only be accessed after stating the occasion and justification, pseudonymises customers, hides message content, attachments and files and is recorded in the tenant's audit log. Only expressly authorised persons of the Processor have access.
• Data access control (tenant separation): the database architecture uses strict Row Level Security (RLS) policies (security rules at row level). Database rules (verification of the tenant_id) make it technically impossible for a user or trainer of the Controller to access data of another tenant (another dog school).

3. Integrity (Art. 32 (1) (b) GDPR)

• Input control: relational database structures and logging tables (e.g. transactions) make it fully traceable when and by whom data (e.g. payments, bookings) was entered or changed.

4. Availability and resilience (Art. 32 (1) (b) and (c) GDPR)

• The use of modern cloud architectures (Vercel, Supabase) ensures high availability and scalability.
• Regular automated backups of the database by the hosting provider protect against accidental data loss.
• Recoverability (Art. 32 (1) (c) GDPR): data can be restored from the hosting provider's backups; application code is versioned and can be reset to an earlier state.
• Abuse protection: limiting of requests per time period (rate limits) on public interfaces and forms, daily limits for sending newsletters.

5. Separation and processing control

• Separation control: data of different dog schools is logically separated via the tenant identifier (tenant_id) and Row Level Security; test and production systems are separate.
• Processing control: sub-processors are selected on the basis of their data protection and security credentials and are contractually bound in accordance with Art. 28 (4) GDPR; support access only takes place in accordance with section 8 and is logged.
• Data minimisation: no open or click tracking of individual newsletter recipients; link pages only count total views and clicks; payment data (card numbers) is processed exclusively by Stripe.

6. Procedure for regular review (Art. 32 (1) (d) GDPR)

• The measures are reviewed in the event of significant changes to the software and at least once a year and adjusted if necessary; security updates of dependencies are applied continuously.